mirror of https://github.com/guillaumemeyer/watermarks-remover.git synced 2026-08-22 13:11:57 +02:00

Files

T

Guillaume Meyer (The Opinionated Man)andGitHub 61440192af feat: optional MarkDiffusion image-watermark harness and purification removal (#57 )

Add an optional harness around THU-BPM/MarkDiffusion (Apache-2.0) for
controlled image-watermark experiments and an alternative pixel-removal engine:

- markdiffusion_harness.py with watermark / detect / purify subcommands for
  nine image schemes (Tree-Ring, Ring-ID, ROBIN, WIND, SFW, Gaussian-Shading,
  GaussMarker, PRC, SEAL); same-scheme/same-model detection only
- clean_image.py --remove-pixel diffusion runs the DiffusionPurification
  regeneration attack (blind regeneration; conservative strength 0.3 default)
- setup_markdiffusion.sh bootstrap (PyPI pin 1.0.2; --checkout editable clone
  at pinned commit), requirements-markdiffusion.txt, Dockerfile.markdiffusion,
  Makefile targets, and mock-based tests (no torch in CI)
- Docs: README section, SKILL.md, removal-matrix.md, vendor-notes.md,
  references/markdiffusion.md

2026-08-14 11:22:40 -07:00

5.2 KiB

Raw Blame History

Vendor notes (public / class-level)

This skill targets mark classes, not reverse-engineered private detectors. Details below are from public docs and the research literature. Algorithms may change.

Industry two-layer model (context)

Product and regulatory guidance often frames AI disclosure as:

C2PA Content Credentials — signed, hard-bound metadata (easy to strip; what this skill removes).
Imperceptible watermark (SynthID-class) — survives strip/re-upload; includes soft binding that can re-attach a remote C2PA manifest.

See: Institute of AI PM — C2PA and SynthID guide (SB 942 / EU AI Act Art. 50 framing). This project only implements the hard-bound / Unicode / rewrite side of that stack.

Anthropic / Claude

Embedded text watermarks at model level (imperceptible; survive copy-paste). Public description matches statistical token-sampling class, not only Unicode.
C2PA Content Credentials on supported files (e.g. PNG, JPEG, SVG).
Models launched on/after 2026-08-02: marking at launch; older models in transition; worldwide.
Detection APIs for third parties: described as forthcoming.
Caveats: mark ⇒ may have been processed by Claude; no mark ≠ human-only; proofreading can stamp human text.

Skill mapping: Layer A (Unicode hygiene) + Layer B (rewrite) + container/image C2PA strip.

Source: How Claude marks AI-generated content.

Google Gemini / SynthID-Text

Nature 2024 paper: Scalable watermarking for identifying large language model outputs (SynthID-Text).
Generative watermarking: modifies next-token sampling (Tournament sampling); detection uses a scoring function + key; no need for the LLM at detect time.
Paper also taxonomizes:
- Edit-based (Unicode / synonym rules) → our Layer A (+ Layer B for synonyms)
- Data-driven / backdoor (trigger phrases) → out of scope
- Generative (sampling) → Layer B best-effort
Productionized in Gemini-scale systems; open research code exists, but production keys are not public — this skill does not ship a SynthID detector.
Optional external verification harness: THU-BPM/MarkLLM (Apache-2.0) reimplements SynthID-Text among other schemes with configurable keys; wired as detect_text_watermark.py / rewrite_text.py --markllm-scheme. Same-config-only — it verifies a mark you generated under a known config, not Google's production keying.
Current frontier production watermarks are token-by-token (streaming constraint); paragraph-level robust methods (SemStamp / PostMark) are not deployed yet, which keeps paraphrase-class attacks effective today.
Optional external reference: aloshdenny/reverse-SynthID provides a reverse-engineered pixel-domain scorer. It is not bundled here, is best-effort, and is under a non-commercial Research License; it is not the official Google detector.
Optional pixel-domain removal: mertizci/noai-watermark's CtrlRegen profile is wired through clean_image.py --remove-pixel ctrlregen / clean_ctrlregen.py. It is not bundled (no LICENSE file → all-rights-reserved), and no local detector certifies the result; the official Google check is the final authority. For Tree-Ring-class marks, the optional MarkDiffusion harness (markdiffusion_harness.py, Apache-2.0) adds a same-scheme detector and a blind-regeneration removal engine (--remove-pixel diffusion) — see references/markdiffusion.md.

Skill mapping: same Layer B rewrite attacks (paraphrase / back-translate / structural) used in the literature against sampling watermarks.

OpenAI / ChatGPT

Public provenance often surfaces as labels, C2PA / Content Credentials on some media exports, and product UI disclosure — not a fully public text-sampling watermark spec comparable to SynthID-Text.
Treat file metadata / C2PA as in-scope when present; treat any unpublished text watermark as the same statistical class → Layer B only, best-effort.
Do not invent algorithm claims.

Skill mapping: container/image metadata strip + Layer A/B on text.

Open-weight / open-LLM (Kirchenbauer-style)

Classic green-list / red-list sampling bias (Kirchenbauer et al.) and variants.
Detectable with the key and tokenizer; removal still relies on heavy paraphrase or regeneration.
Optional external harness: MarkLLM (detect_text_watermark.py --scheme kgw) reproduces KGW detection under a config you control, for controlled before/after experiments.

Skill mapping: Layer B multi-pass; prefer rewrite with a different model family when possible.

Cross-vendor hygiene rule

Suspected origin	Prefer rewrite backend
Claude	Non-Claude (local Ollama, other API)
Gemini	Non-Gemini
OpenAI	Non-OpenAI
Unknown	Local open-weight if available

Prefer local open-weight backends and avoid any known-watermarked vendor, not just the suspected origin. Then re-run Layer A on the rewritten text.

5.2 KiB Raw Blame History